CISA flags two actively exploited Ivanti Connect Secure flaws; Anthropic researchers build remote-root Linux MPTCP exploit
A single day brought confirmed active exploitation of Ivanti Connect Secure, a remote unauthenticated root exploit for the Linux kernel, and six critical Chrome fixes.
CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities Catalog on 30 October, based on evidence of active exploitation. CISA's alert describes the two as a missing-authentication-for-critical-function flaw and a predictable-identifier generation flaw in Ivanti Connect Secure. CISA states these vulnerability types are a frequent attack vector for malicious cyber actors, and that Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of KEV entries. If you run Ivanti Connect Secure, treat remediation as an active-exploitation priority.
BleepingComputer reported that security researchers at Anthropic developed an exploit for a critical Linux kernel vulnerability that lets unauthenticated attackers remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. Inventory hosts with MPTCP listeners exposed to untrusted networks and track the kernel vendor's patch.
Google's advisory lists six critical Chrome vulnerabilities fixed in the stable channel. CVE-2026-119263 and CVE-2026-119261, both carrying a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6, affect Chrome up to the fix in 156.0.8078.79. CVE-2026-118355, CVE-2026-118342 and CVE-2026-118340 share the same vector and 9.6 score and are fixed in 156.0.8078.73. CVE-2026-118337, scored 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, is fixed in the same 156.0.8078.73 build. Update Chrome to the versions Google names.
SecurityWeek reported that over 22.6 million exposed instances are potentially affected by critical PHP flaws targeted for over a week, and that PHP2Shell attacks root Palo Alto firewalls but fail against WordPress.
The Hacker News reported that TeamViewer fixed a flaw that lets the controlled host in a session attack the viewer machine that connected to control it.
On breaches: The Record reported that Florida's Department of Education said 4.9 million people had Social Security numbers leaked in a Florida Student Financial Aid website breach it became aware of on 19 October; The Record reported that fashion retailer Resolve said a hack exposed customer payment card numbers; and BleepingComputer reported that Trezor received credible reports of a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia.
Sources
- BleepingComputer — Critical Linux kernel flaw allows remote root attacks on MPTCP servers
- The Record — DOJ raises privacy concerns over potential sale of Character.AI chats
- The Register — Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see
- The Hacker News — Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
- SecurityWeek — PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- Help Net Security — Assad regime hacker who caused $136 billion market drop sentenced to 42 months
- CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog
- BleepingComputer — Linux kernel exploit enables remote root attacks on MPTCP servers
- The Record — Fashion retailer Resolve says hackers stole payment card information
- The Register — GM cracks the petty cash box for multistate driver tracking settlement
- The Register — Anthropic: That Claude Code extension compromise… couldn't be us
- BleepingComputer — Trezor warns of suspected crypto-theft implant in hardware wallet
- The Record — Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach
- The Hacker News — TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them